I'm designing a cookie for authentication purposes. In case of success, this will go into an application.
Here are the things I've included in this cookie:
- It's for web of course
- It includes some data about the authenticated user, for performance purposes (UserId is the least data)
- It includes a salt (extra data) that is only known to the server, to prevent cookie-forgery attacks
- The whole cookie's value is encrypted via AES
- It appends a token from client data for the purpose of preventing cookie-hijacking (client IP is not included because of each network change, another login would become mandatory). In fact, it only includes UserAgent header
- It's HttpOnly, to prevent from XSS attacks gaining access to cookie (yet still vulnerable to CSRF)
- It's expiration is set to one month, because of better UX (people don't like to always login after closing the browser)
We've done this till here, and tested and it works just fine. What possible attacks are still possible via this design and how can we make it more secure?